3224e26e83d61cda9f5cdaade27f4d81

Sharing

Copy URL

Twitter E-mail

General

Target

3224e26e83d61cda9f5cdaade27f4d81
Size

2.4MB
MD5

3224e26e83d61cda9f5cdaade27f4d81
SHA1

36e29323587133c3e2084f8a0663978a5dbbb343
SHA256

bdf974d1978e016f60b1229dea8820c5bc8dae5d2abc611aec80b5012f807518
SHA512

75796e3b2a36e53a2e1ac56bfbce633624f5ed8a6c3e87dc083d2ab6d0bb78883519ee023a0d1edfc6a3eea9828cee5335d21f9e4dc8161c1780c9145e0bb8d1
SSDEEP

49152:bJFny39HGjT6EqukMB4b6xMnrxZdy/lKlvDXDXMZ0i5WkD+oMH5s:XnytHGjT54mxMS4TzSb0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3224e26e83d61cda9f5cdaade27f4d81

Files

3224e26e83d61cda9f5cdaade27f4d81
.exe windows:5 windows x86 arch:x86

37576ac1f4d1b6542575bd0db48a8380

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
Process32Next
TerminateProcess
FindFirstFileA
FindNextFileA
FindClose
GetVersionExA
GetProcAddress
GetModuleHandleA
GetCurrentProcess
GetLogicalDriveStringsA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
QueryDosDeviceA
GetFileSize
ReadFile
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetComputerNameA
GetFullPathNameA
GetUserDefaultLangID
GetSystemInfo
OpenMutexA
CreateToolhelp32Snapshot
SetEvent
GetCurrentProcessId
CreateMutexA
LocalFree
SetLastError
InterlockedIncrement
SetErrorMode
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
IsWow64Process
GetFileType
SetFilePointer
SetEndOfFile
CreateFileW
SetStdHandle
WriteConsoleW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleFileNameW
GetLocaleInfoW
LoadLibraryW
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
WriteFile
SizeofResource
LoadResource
FindResourceA
OpenEventW
DeviceIoControl
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
CreateFileA
ExpandEnvironmentStringsA
GetPrivateProfileStringA
GetPrivateProfileIntA
Sleep
OpenEventA
OpenProcess
CloseHandle
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
SetFileAttributesA
WaitForSingleObject
CreateEventA
OutputDebugStringA
DeleteFileA
GetFileAttributesA
GetLastError
lstrlenW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
RaiseException
HeapSetInformation
GetCommandLineA
GetCurrentThreadId
ExitProcess
CreateThread
ResumeThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement

user32

GetWindowTextA
EnumDisplayMonitors
GetSystemMetrics
EnumDisplaySettingsA
GetClassNameA
GetDesktopWindow
EnumChildWindows
GetWindowThreadProcessId
TranslateMessage
DispatchMessageA
FindWindowA
GetMonitorInfoA
PeekMessageA

advapi32

SetNamedSecurityInfoA
GetExplicitEntriesFromAclA
InitializeAcl
AddAce
GetNamedSecurityInfoA
GetAclInformation
GetAce
IsValidSid
LookupAccountNameA
CopySid
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA
RegEnumKeyExA
CreateServiceA
StartServiceA
ControlService
RegFlushKey
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
OpenServiceA
OpenSCManagerA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear

shlwapi

PathAddBackslashA
PathFileExistsA

ws2_32

inet_ntoa
gethostname
WSAStartup
socket
WSACleanup
inet_addr
connect
closesocket
send
recv
WSAGetLastError
select
ioctlsocket
htons
gethostbyname
setsockopt

wininet

InternetCrackUrlA

urlmon

URLDownloadToFileA

psapi

GetModuleFileNameExA
GetProcessImageFileNameA

ntdll

NtListenPort
NtClose
NtCreatePort
RtlInitUnicodeString
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

Sections

.text
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37576ac1f4d1b6542575bd0db48a8380

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wininet

urlmon

psapi

ntdll

version

Sections

.text Size: 308KB - Virtual size: 308KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 7KB - Virtual size: 19KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 47KB - Virtual size: 47KB

.text
Size: 308KB - Virtual size: 308KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 7KB - Virtual size: 19KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 47KB - Virtual size: 47KB